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(54) Radiation-resistant computing system 

i^pt^u " " ' "'' 

4*0g\ (57) In a n elec tronic computing s ystem a memory 36, an 
s™* 1 * out put device T3 r^g^w ^pply!"^nge ^ a 
ZttA timing device 18 which is responsive To .o nsetlof ionizing 

ot Us$ radiation aTe" hardened against the _effects of such 

vulwM* ractlitidn . Other coTn^nents^f~the~system, such as a 
fcenfiefiihQf prooessor 3Q anc j an i nput device 3 4 for the processor 30 
ftfiS^jxMp-^ are^j ^bT^adiation-hardened^ and the power supply 
of coim/om+ff arrangement 17 is responsive to signals from the timing 
t/nUer hu dev ' ce 18 consequent on onset of radiation to depower the 
c q t non-hardened components for the duration of the 
° r itiw°* radiation. The output device 13 includes means responsive 
to signals from the timing device 18 to retain signals 
present at the onset of radiation, for the duration of that 
radiation. 
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2279780 

1 

RADIATION-RESISTANT ELECTRICAL CIRCUITS 

It is known to make electronic components which 
'are designed to operate satisfactorily at predetermined 
values of ionizing radiation, as for example that 
resulting from a nuclear explosion. Occurrence of such 
radiation is commonly referred to as a "nuclear event 1 ' 
and such components are commonly known as "nuclear- 
hardened components" . 

Such components are expensive, and many sub- 
systems which are .required for a particular function may 
not be available in nuclear-hardened form. 

It has been proposed in US ^-4687 622_bo^ provid e^a 
system having a nuclear-h ydened^ra diat ion det ector which 
effectively shuts down the remainder of the system for a 
time which is anticipated as being the duration of the 
damaging radiation^/ It is a disadvantage that operation 
system is lost for the whole of that time, which 
critically disadvantageous in a computer system. 

It is an object of the invention to provide an 
electronic computing system in^ which not all components 
are nuclear hardened, but in which the effective 
operation of the system is interrupted for a minimum 
time. This objec t_is achi ev ed b y providing that onl y 
essential a nd vulnerable components of th e system j re_ 
nuclear-hardened and that other vulnerable components are 
de^wered^o^a time, hereinafter feferre'd to as the 
"critical period", which is at least as long as that 
required for the ionizing radiation to fall below a level 
critical for those components, hereinafter referred to as 
the "critical level". The ob ject is furt her obtained by 
causing output signals from the system to be ma^nt^^ied^ 



"of the 
may be 
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for the d epowered pe ri od at. values exis ting at the start 
of that period. " — - — ■ 

According to the invention there is provided an 
n/fc^ a ^^ ele ctronic computing syst em having a ^processor , input and 

outp ut devices f or said processor, a memor y, a power 
supply arrangement, a timing device responsive to a 
nuclear event, as herein defined, for generating control 
signals, said me mory, output device, power supply 
arrangement a nd timing device bei ng nuclear hard, as 
herein defined, said control signals having a duration 
which is a t leas t_egu'al_jto the critical p erio d, as herein 
defined, of at least said processor and s aid input 
| ^ ^^device, means responsive to said ^control signals for 
C^om^O) f/^hqlg isolating power f rbm~said"~supply " arrangement to 

componen ts of the system other than said nuclear hard 
components, means_j^esponsive to said control signals for 
resetting said processor at~~the end of said critical 
period, said output device including means, responsive to 
said control signals for retaining signals present 
therein at the beginning of said critical period, for the 
duration thereof . 



/ 

In a preferred embodiment said proce ssor is _^a 
di gital proce ssor. 

A particular embodiment includes i^ut-ou^t pujb^ 
buffers for said memory and means responsive ~tb said 
control signals fo r ^^4biti ng wrating operations into 
said memory for the duration of said control signals. 



A further embodiment includes a seco nd^ memory , and 

means for isolating said second memory from said power 

'^g^T^ ■ — 

^supp ly arrangement for the duration of said control 

signals . 
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fat or? ft* 



An embodiment of the invention will now be 
described by way of example only and with reference to 
the accompanying drawings in which 

Figure 1 shows, diagrammatically, the principle of 
the present invention, 

Figure 2 is a diagram of an electrical control 
system for an electrically powered actuator, 

Figure 3 is a diagram of a power supply 
arrangement and of one element of a timer arrangement 
forming part of Figure 2, and 

Figure 4 is a diagram of an output device forming 
part of Figure 2 . 

Figure 1 shows a control system for an electrical 
actuator 110. A m icroprocessor 11 1 coimn unicates vi a_a 
b us 112 w ith^a RAM 113 and an EPROM 114. Program 
instructions from the EPROM 14 are decoded in a logic 
circuit 115 and used by the microprocessor 111 to 
generate digital commands for the actuator 110 . The 
digital commands are supplied on the bus 112 to a 
digital-to-analo g' converte r 116 whose analog output is 
applied via a sample and hold circuit 117 to an amplifier 
118, the output from which operates the actuator 110. 
Feedback signals from the actuator 110 are supplied on a 
line 119 to the input of the amplifier 118, and also to 
an analog-to digital converter 120, which supplies 
digital signals to the bus 112. The microprocessor 111 
communicates via the bus 112 with a dual-port RAM 121 
which can store status parameters of the system, for 
communication to a further microprocessor (not shown). 

The micrg^o cessor 111, the RAM 113 and the EPROM 
114, the logic circuit 115 and the circuits 116,120 may 
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be considered as forming a block 122. The sample and 
hold circuit 117, the amplifier 118, the dual-port RAM 
121 and a device 124 may be considered as included in a 
block 123. The device 124 responds to the onset of a 
nuclear event by generating a signal on a line 125, the 
duration of that signal being at least as long as the 
longest critical period of any of the components in the 
block 122. All of the components in the block 123, and 
the actuator 110, are nuclear hardened. 

The action of the signal on line 125 is to depower 
the components in the block 122 for at least their 
critical periods, and to inhibit "write 11 operations from 
the microprocessor 111. At the end of a signal on line 
125 the components in the block 122 are re-powered and 
reset. Since the RAM 121 is hardened, and because of the 
absence of "write 11 operations during a nuclear event, the 
status information in the RAM 121 is immediately 
available thereafter to continue normal operation. The 
hardened sample and hold circuit 117 maintains the output 
signals to the actuator at their value immediately 
preceding a nuclear event, for the duration of that 
event . 

Figure 2 shows a system for controlling current 
supply to a torque motor 10 which controls a valve 11. 
In the described embodiment the valve 11 forms part of a 
gas turbine engine fuel control system. The torque motor 
10 is responsive to signals on a line 12 from an output 
device 13, shown in more detail in Figure 4, which is in 
turn responsive to digital signals on a bus 14 and to 
position feed-back signals on a line 15 from the valve 
11. The output device 13 is energized by a 15 volt 
supply on a line 16 from a power supply arrangement 17, 
shown in detail in Figure 3. The device 13 is supplied 
with a control signal from a timer arrangement 18 which 
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is responsive to a critical level of ionizing radiation, 
to generate control signals on lines 19, 20, 21, 22. 

The system shown in Figure 2 includes f^st_and_^ 
s econd mi croprocessors 30, 31 which respectively 
communicate with ~the~bus 14 and aj>us_46 through 
respective buffer_circui ts 32, 33 . The bus 14 receives 
signals from an input device 34 which is responsive to 
signals on lines 35, these latter corresponding to 
parameters to which the valve 11 is required to respond. 
Also communicating with the respective buses 14, 46 are 
first and second memories 27, 28, each of which includes 
both~EPROlTand RAM devices. The microprocessors 30,31 
can intercommunicate via a dual port RAM. 36 which 
interconnects the two buses 14, 46 and which is used to 
store "status" information, that is information which 
will enable the processor 30, 31 to be reset quickly on 
receipt of a signal on the line 21, to a condition which 
existed immediately prior to a nuclear event. The memory 

36 includes tri-state buffers which are responsive to the 
signal on line 20 to disconnect that memory from the 
buses 14, 46, the information on which may be corrupted 
during a nuclear event. 

A discrete output register 29 supplies a plurality 
of discrete signals for the system. One of these signals 
is applied on a line 86 to the output circuit 13, the 
function of that signal being described below. 

In addition to the 15 volt supply on the line 16 
the power supply arrangement provides 15 volts on a line 

37 to a DC-DC converter 38,' and 5 volts supply on a line 
39 to the mi croprocessors 3 0, 31, the £uj|j£s_32, 33, the 
input device 34 and the memories 27, 28. The_ convert er 

38 provides a 5 volt supply on a line 40 to the memory 
36. 
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The timer arrangement 18 includes additional timer 
units which generate the control signals on 19 to 22. 
The signal on line 19 is applied to the device 13 to hold 
the output signal therein at a value existing at the 
onset of the nuclear event. The control signal on line 
20 is applied to the memory 36 to stop information being 
written in that memory for the duration of the nuclear 
event. The signal on line 20 also ensures that a "write" 
operation, once initiated, is allowed to be completed. A 
signal on line 21 is applied to the m icrop roc essor 3Q_^ 31 
to reset these after the end of the critical period. The 
signal on line 22 is applied to the buffers 32, .33 to 
disable them for the duration of the critical period. 

As shown in Figure 3 the power supply arrangement 
17 comprises a transformer 41 having a primary winding 42 
supplied with AC and secondary windings 43, 44, 45 from 
which the DC supplies on respective lines 16, 37, 40 are 
derived. Figure 2 also shows one timer unit 50 of the 
timer arrangement . 18 . The unit 50 includes an npn 
transistor 51 across the base and collector of which is 
connected a positive, intrinsic negative (PIN) diode 52. 
The base and emitter of the transistor 51 are connected 
to a +15 volt rail 53 through respective resistors 54, 
55. The collector is also connected to the rail 53 
through a capacitor 56 and to a control line 57 through a 
resistor 58. 

A p-channel FET 70 is connected in the +5 volt 
line 71 of the supply 39, and an n-channel FET 72 is 
connected between the line 71 and a 0 volt rail 73. The 
control line 57 is collected directly to the gate of the 
FET 70 and to -15 volt through series resistors 74, 75. 
The junction of resistors 74, 75 is connected to the gate 
of FET 72. The arrangement is such that when the diode 
52 is not conducting, voltage on the base of the 
transistor 51 isolates the line 57 from the 15 volt rail 
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53, and the gates of FETs 70 and 72 are negative, so that 
FET 70 conducts and FET 72 is open circuit. The diode 52 
conducts in response to a critical level of ionizing 
radiation, turning on transistor 51 and switching off FET 
70 which isolates the +5 volt line 71 and de-energises 
all components supplied thereby. A short time later the 
FET 72 switches on, shorting the line 71 and de-latching 
any latched-up components powered thereby. The FETs 70, 
72 respectively remain off and on for a time determined 
by the capacitor 56 and resistors 74, 75, that time being 
at least equal to the longest critical period of the 
microprocessor 30, 31, the buffers 32,33 the input device 
34 and the memories 27, 28. These latter components are 
thus de-powered for at least that period. 

As shown in Figure 4 the output device 13 is 
associated with a JD-A converter 8 0 ^e~spomri-ve— to-output 
sigjials~on the bus 14 . An alog signal s from the converter 
80 are supplied to a s amp 1 e~and~hoTd circuit 81 which is 
responsive to control signals on the line 19 to retain 
the most recent' value of the analog signal from the 
converter 80, that value representing a desired operating 
position of the valve 11 (Figure 2). The analog jvalue in 
circuit 81 is applied to one input of a difference 
amplifier 82, whose other input receives^tlae_^osition 
feed-back signal orTline~Tr7ram~the valve 11. The 
ampTifl."er~ - 8Tl5rovides "an" output sign^X^olTTine 12 to the 
torque motor 10. When the system is operating, an enable 
signal for the torque motor 10 is normally provided on a 
line 86 from the" discrete output register 29. That 
signal may "cease when the processors 30, 31 and the 
memories 27,. 28 are shut down, and the "write" function 
of the memory 36 is interrupted during a nuclear event. 
Accordingly, the control signal on line 19 is also 
applied to a relay 84 which connects the line 83 to a 
voltage supply 85, thereby maintaining the torque motor 
10 in an enabled condition, whereby it may be held in its 
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last operated position for the duration of the signal on 
line 19. 

The components of the output device 13, as well as 
the torque motor 10 and valve 11, are either inherently 
nuclear-hard, or can relatively inexpensively be made so. 
This is also the case with the power supply arrangement 
17, the timer arrangement 18 and the DC-DC converter 38. 
The remaining elements of the system, with the 
expectation of memory 36, are depowered and/or inhibited 
for the duration of a nuclear event. Thus the only part 
of the system which requires specific effort to effect 
nuclear hardening is the memory 36. Furthermore the 
system is out of action only for the duration of the 
signals on lines 19, 20 and 22, that is for about 10 
msec, and is immediately reset thereafter, the torque 
motor 10 and valve 11 being held stationary for that 10 
msec period. 

The valve 11 is thus maintained in a closed-loop 
control for the duration of the nuclear event rather than 
being merely "frozen" . This is achieved by holding the 
valve demand at the value obtaining immediately prior to 
the event. No time is therefore required for the valve 
analog circuitry to reset when normal operation is 
resumed . 
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CLAIMS 



1 An electronic comput ing system having a processor, 
input and output devices~~ror said processor, a memory, a 
power supply arrangement, a timing Hevice responsive to a' 
nuclear event, as herein defined, for generating control 
signals, said memory, output device, power supply 
arrangement and timing device being nuclear hard, as 
herein defined, said control signals having a duration 
which is at least equal to the critical period, as herein 
defined, of at least said processor and said input 
device, means responsive to said control signals for 
isolating power from said supply arrangement to 
components of the system other than said nuclear hard 
components, means responsive to said control signals for 
resetting said processor at the end of said critical 
period, said output device including means, responsive to 
said control signals for retaining signals present 
therein at the beginning of said critical period, for the 
duration thereof . 

2 A system as claimed in claim 1 in which said power 
supply arrangement includes a portion for supplying power 
to said non-nuclear hard components only, said portion 
including a switching device responsive to one of said 
control signals. 

3 A system as claimed in claim 3 in which said 
switching device comprises a first switch component for 
isolating an output supply line from an input voltage 
source, and a second switch component for shorting said 
output supply line to ground. 

4 A system as claimed in any preceding claim in 
which said output device includes means for supplying an 
enabling signal and an o utput control signal to an 
external device, said output ~d^vice~Be ing responsive to a 
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control signal from said timing device to isolate said 
external device from said output control signal and to 
derive said enabling signal from a voltage supplied by 
said power supply arrangement. 

5 A system as claimed in claim 4 in which said 
output device comprises a digital-to-analog converter and 
an analog sample and hold device for retaining the latest 
analog signal from said converter. 

6 A system as claimed in any preceding claim in 
which said memory is adapted to store information whose 
status corresponds to that existing immediately prior to 
a nuclear event. 

7 A system as claimed in claim 6 in which said 
memory includes means responsive to one of the control 
signals from said timer, for isolating said memory from 
said microprocessor and said input and output devices. 

8 A system as hereinbefore described with reference 
to Figure 1 or Figures 2 to 4 . 
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•4) Radiation-resistant computing system 



(57) In an electronic computing system a memory 36, an 
output device 13, a power supply arrangement 17 and a 
timing device 18 which is responsive to onset of ionizing 
radiation are hardened against the effects of such 
radiation. Other components of the system, such as a 
processor 30 and an input device 34 for the processor 30 
are not radiation-hardened, and the power supply 
arrangement 17 is responsive to signals from the timing 
device 18 consequent on onset of radiation to depowerthe 
non-hardened components for the duration of the 
radiation. The output device 13 includes means responsive 
to signals from the timing device 18 to retain signals 
present at the onset of radiation, for the duration of that 
radiation. 
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2279780 



RADIATION-RESISTANT ELECTRICAL CIRCUITS 

It is known to make electronic components which 
are designed to operate satisfactorily at predetermined 
values of ionizing radiation, as for example that 
resulting from a nuclear explosion. Occurrence of such 
radiation is commonly referred to as a "nuclear event" 
and such components are commonly known as "nuclear- 
hardened components". 

Such components are expensive, and many sub- 
systems which are .required for a particular function may 
not be available in nuclear-hardened form. 

It has been proposed in US-A-4687622 to provide a 
system having a nuclear-hardened radiation detector which 
effectively shuts down the remainder of the system for a 
time which is anticipated as being the duration of the 
damaging radiation. It is a disadvantage that operation 
of the system is lost for the whole of that time, which 
may be critically disadvantageous in a computer system. 

It is an object of the invention to provide an 
electronic computing system in which not all components 
are nuclear hardened, but in which the effective 
operation of the system is interrupted for a minimum 
time. This object is achieved by providing that only 
essential and . vulnerable components of the system are 
nuclear-hardened and that other vulnerable components are 
depowered for a time, hereinafter referred to as the 
"critical period", which is at least as long as that 
required for the ionizing radiation to fall below a level 
critical for those components, hereinafter referred to as 
the "critical level". The object is further obtained by 
causing output signals from the system to be maintained 
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for the depowered period at values existing at the start 
of that period. 

According to the invention there is provided an 
electronic computing system having a processor, input and 
output devices for said processor, a memory, a power 
supply arrangement, a timing device responsive to a 
nuclear event, as herein defined, for generating control 
signals, said memory, output device, power supply 
arrangement and timing device being nuclear hard, as 
herein defined, said control signals having a duration 
which is at least equal to the critical period, as herein 
defined, of at least said processor and said input 
device, means responsive to said control signals for 
isolating power from said supply arrangement to 
components of the system other than said nuclear hard 
components, means responsive to said control signals for 
resetting said processor at the end of said critical 
period, said output device including means, responsive to 
said control signals for retaining signals present 
therein at the beginning of said critical period, for the 
duration thereof. 

In a preferred embodiment said processor is a 
digital processor. 

A particular embodiment includes input-output 
buffers for said memory and means responsive to said 
control signals for inhibiting writing operations into 
said memory for the duration of said control signals. 

A further embodiment includes a second memory, and 
means for isolating said second memory from said power 
supply arrangement for the duration of said control 
signals . 
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An embodiment of the invention will now be 
described by way of example only and with reference to 
the accompanying drawings in which 

Figure 1 shows, diagrammatically, the principle of 
the present invention, 

Figure 2 is a diagram of an electrical control 
system for an electrically powered actuator, 

Figure 3 is a diagram of a power supply 
arrangement and of one element of a timer arrangement 
forming part of Figure 2, and 

Figure 4 is a diagram of an output device forming 
part of Figure 2 . 

Figure 1 shows a control system for an electrical 
actuator 110. A microprocessor 111 communicates via a 
bus 112 with a RAM 113 and an EFROM 114. Program 
instructions from the EPROM 14 are decoded in a logic 
circuit 115 and used by the microprocessor 111 to 
generate digital commands for the actuator 110. The 
digital commands are supplied on the bus 112 to a 
digital-to-analog converter 116 whose analog output is 
applied via a sample and hold circuit 117 to an amplifier 
118, the output from which operates the actuator 110. 
Feedback signals from the actuator 110 are supplied on a 
line 119 to the input of the amplifier 118, and also to 
an analog-to digital converter 120, which supplies 
digital signals to the bus 112. The microprocessor 111 
communicates via the bus 112 with a dual-port RAM 121 
which can store status parameters of the system, for 
communication to a further microprocessor (not shown). 

The microprocessor 111, the RAM 113 and the EPROM 
114, the logic circuit 115 and the circuits 116,120 may 
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be considered as forming a block 122. The sample and 
hold circuit 117, the amplifier 118, the dual-port RAM 
121 and a device 124 may be considered as included in a 
block 123. The device 124 responds to the onset of a 
nuclear event by generating a signal on a line 125, the 
duration of that signal being at least as long as the 
longest critical period of any of the components in the 
block 122. All of the components in the block 123, and 
the actuator 110, are nuclear hardened. 

The action of the signal on line 125 is to depower 
the components in the block 122 for at least their 
critical periods, and to inhibit "write" operations from 
the microprocessor 111. At the end of a signal on line 
125 the components in the block 122 are re-powered and 
reset. Since the RAM 121 is hardened, and because of the 
absence of "write" operations during a nuclear event, the 
status information in the RAM 121 is immediately 
available thereafter to continue normal operation. The 
hardened sample and hold circuit 117 maintains the output 
signals to the actuator at their value immediately 
preceding a nuclear event, for the duration of that 
event . 

Figure 2 shows a system for controlling current 
supply to a torque motor 10 which controls a valve 11. 
In the described embodiment the valve 11 forms part of a 
gas turbine engine fuel control system. The torque motor 
10 is responsive to signals on a line 12 from an output 
device 13, shown in more detail in Figure 4, which is in 
turn responsive to digital signals on a bus 14 and to 
position feed-back signals on a line 15 from the valve 
11. The output device 13 is energized by a 15 volt 
supply on a line 16 from a power supply arrangement 17, 
shown in detail in Figure 3 . The device 13 is supplied 
with a control signal from a timer arrangement 18 which 
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is responsive to a critical level of ionizing radiation, 
to generate control signals on lines 19, 20, 21, 22. 

The system shown in Figure 2 includes first and 
second microprocessors 30, 31 which respectively 
communicate with the bus 14 and a bus 46 through 
respective buffer circuits 32, 33. The bus 14 receives 
signals from an input device 34 which is responsive to 
signals on lines 35, these latter corresponding to 
parameters to which the valve 11 is required to respond. 
Also communicating with the respective buses 14, 46 are 
first and second memories 27, 28, each of which includes 
both EPROM and RAM devices. The microprocessors 30,31 
can intercommunicate via a dual port RAM 36 which 
interconnects the two buses 14 , 46 and which is used to 
store "status" information, that is information which 
will enable the processor 30, 31 to be reset quickly on 
receipt of a signal on the line 21, to a condition which 
existed immediately prior to a nuclear event. The memory 

36 includes tri-state buffers which are responsive to the 
signal on line 20 to disconnect that memory from the 
buses 14, 46, the information on which may be corrupted 
during a nuclear event. 

A discrete output register 29 supplies a plurality 
of discrete signals for the system. One of these signals 
is applied on a line 86 to the output circuit 13, the 
function of that signal being described below. 

In addition to the 15 volt supply on the line 16 
the power supply arrangement provides 15 volts on a line 

37 to a DC-DC converter 38, and 5 volts supply on a line 
39 to the microprocessors 30, 31, the buffers 32, 33, the 
input device 34 and the memories 27, 28. The converter 

38 provides a 5 volt supply on a line 40 to the memory 
36 . 
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The timer arrangement 18 includes additional timer 
units which generate the control signals on 19 to 22. 
The signal on line 19 is applied to the device 13 to hold 
the output signal therein at a value existing at the 
onset of the nuclear event. The control signal on line 
20 is applied to the memory 36 to stop information being 
written in that memory for the duration of the nuclear 
event. The signal on line 20 also ensures that a "write" 
operation , once initiated, is allowed to be completed. A 
signal on line 21 is applied to the microprocessor 30, 31 
to reset these after the end of the critical period. The 
signal on line 22 is applied to the buffers 32, 33 to 
disable them for the duration of the critical period. 

As shown in Figure 3 the power supply arrangement 
17 comprises a transformer 41 having a primary winding 42 
supplied with AC and secondary windings 43, 44, 45 from 
which the DC supplies on respective lines 16, 37, 40 are 
derived. Figure 2 also shows one timer unit 50 of the 
timer arrangement 18 . The unit 50 includes an npn 
transistor 51 across the base and collector of which is 
connected a positive, intrinsic negative (PIN) diode 52. 
The base and emitter of the transistor 51 are connected 
to a +15 volt rail 53 through respective resistors 54, 
55. The collector is also connected to the rail 53 
through a capacitor 5 6 and to a control line 57 through a 
resistor 58. 

A p-channel FET 70 is connected in the +5 volt 
line 71 of the supply 39, and an n-channel FET 72 is 
connected between the line 71 and a 0 volt rail 73. The 
control line 57 is collected directly to the gate of the 
FET 70 and to -15 volt through series resistors 74, 75. 
The junction of resistors 74, 75 is connected to the gate 
of FET 72. The arrangement is such that when the diode 
52 is not conducting, voltage on the base of the 
transistor 51 isolates the line 57 from the 15 volt rail 
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53, and the gates of FETs 70 and 72 are negative, so that 
FET 70 conducts and FET 72 is open circuit. The diode 52 
conducts in response to a critical level of ionizing 
radiation, turning on transistor 51 and switching off FET 
70 which isolates the +5 volt line 71 and de-energises 
all components supplied thereby. A short time later the 
FET 72 switches on, shorting the line 71 and de-latching 
any latched-up components powered thereby. The FETs 70, 
72 respectively remain off and on for a time determined 
by the capacitor 56 and resistors 74, 75, that time being 
at least equal to the longest critical period of the 
microprocessor 30, 31, the buffers 32,33 the input device 
34 and the memories 27, 28. These latter components are 
thus de-powered for at least that period. 

As shown in Figure 4 the output device 13 is 
associated with a D-A converter 80 responsive to output 
signals on the bus 14. Analog signals from the converter 
80 are supplied to a sample and hold circuit 81 which is 
responsive to control signals on the line 19 to retain 
the most recent' value of the analog signal from the 
converter 80, that value representing a desired operating 
position of the valve 11 (Figure 2). The analog value in 
circuit 81 is applied to one input of a difference 
amplifier 82, whose other input receives the position 
feed-back signal on line 15 from the valve 11. The 
amplifier 82 provides an output signal on line 12 to the 
torque motor 10. When the system is operating, an enable 
signal for the torque motor 10 is normally provided on a 
line 86 from the discrete output register 29. That 
signal may cease when the processors 30, 31 and the 
memories 27,. 28 are shut down, and the "write" function 
of the memory 36 is interrupted during a nuclear event. 
Accordingly, the control signal on line 19 is also 
applied to a relay 84 which connects the line 83 to a 
voltage supply 85, thereby maintaining the torque motor 
10 in an enabled condition, whereby it may be held in its 
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last operated position for the duration of the signal on 
line 19. 

The components of the output device 13 , as well as 
the torque motor 10 and valve 11, are either inherently 
nuclear-hard, or can relatively inexpensively be made so. 
This is also the case with the power supply arrangement 
17, the timer arrangement 18 and the DC-DC converter 38. 
The remaining elements of the system, with the 
expectation of memory 36, are depowered and/or inhibited 
for the duration of a nuclear event. Thus the only part 
of the system which requires specific effort to effect 
nuclear hardening is the memory 36. Furthermore the 
system is out of action only for the duration of the 
signals on lines 19, 20 and 22, that is for about 10 
msec, and is immediately reset thereafter, the torque 
motor 10 and valve 11 being held stationary for that 10 
msec period. 

The valve 11 is thus maintained in a closed-loop 
control for the duration of the nuclear event rather than 
being merely "frozen 11 . This is achieved by holding the 
valve demand at the value obtaining immediately prior to 
the event. No .time is therefore required for the valve 
analog circuitry to reset when normal operation is 
resumed. 
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CLAIMS 

1 An electronic computing system having a processor, 
input and output devices for said processor, a memory, a 
power supply arrangement, a timing device responsive to a 
nuclear event, as herein defined, for generating control 
signals, said memory, output device, power supply 
arrangement and timing device being nuclear hard, as 
herein defined, said control signals having a duration 
which is at least equal to the critical period, as herein 
defined, of at least said processor and said input 
device, means responsive to said control signals for 
isolating power from said supply arrangement to 
components of the system other than said nuclear hard 
components, means responsive to said control signals for 
resetting said processor at the end of said critical 
period, said output device including means, responsive to 
said control signals for retaining signals present 
therein at the beginning of said critical period, for the 
duration thereof. 

2 A system as claimed in claim 1 in which said power 
supply arrangement includes a portion for supplying power 
to said non-nuclear hard components only, said portion 
including a switching device responsive to one of said 
control signals. 

3 A system as claimed in claim 3 in which said 
switching device comprises a first switch component for 
isolating an output supply line from an input voltage 
source, and'a second switch component for shorting said 
output supply line to ground. 

4 A system as claimed in any preceding claim in 
which said output device includes means for supplying an 
enabling signal and an output control signal to an 
external device, said output device being responsive to a 
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control signal from said timing device to isolate said 
external device from said output control signal and to 
derive said enabling signal from a voltage supplied by 
said power supply arrangement. 

5 A system as claimed in claim 4 in which said 
output device comprises a digital-to-analog converter and 
an analog sample and hold device for retaining the latest 
analog signal from said converter. 

6 A system as claimed in any preceding claim in 
which said memory is adapted to store information whose 
status corresponds to that existing immediately prior to 
a nuclear event . 

7 A system as claimed in claim 6 in which said 
memory includes means responsive to one of the control 
signals from said timer, for isolating said memory from 
said microprocessor and said input and output devices . 

8 A system as hereinbefore described with reference 
to Figure ,1 or Figures 2 to 4 • 
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